diff --git a/.github/workflows/ci-expanded.yml b/.github/workflows/ci-expanded.yml
index 2eb153f72..03638d894 100644
--- a/.github/workflows/ci-expanded.yml
+++ b/.github/workflows/ci-expanded.yml
@@ -14,6 +14,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.repository_owner == 'libbitcoin' && (github.event.pull_request.number || github.run_id) || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   information:
     runs-on: ubuntu-latest
@@ -21,6 +24,9 @@ jobs:
     env:
       CONCURRENCY_GROUP: ${{ github.workflow }}-${{ github.repository_owner == 'libbitcoin' && (github.event.pull_request.number || github.run_id) || github.ref }}
 
+    permissions:
+      actions: write
+
     steps:
         - name: state
           run: |
@@ -33,6 +39,14 @@ jobs:
             echo "base_ref : ${{ github.base_ref }}"
             echo "head_ref : ${{ github.head_ref }}"
 
+        - name: cancel on pull_request closed
+          if: github.event_name == 'pull_request' && github.event.action == 'closed'
+          env:
+            GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          run: |
+            gh api --method POST \
+              -H "Accept: application/vnd.github+json"   "/repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/cancel"
+
 
   gnu:
     if: github.event_name != 'pull_request' || github.event.action != 'closed'
@@ -355,7 +369,7 @@ jobs:
       - name: Checkout repository [libbitcoin-system]
         id: checkout-libbitcoin-system
         continue-on-error: true
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
           path: 'libbitcoin-system'
@@ -372,7 +386,7 @@ jobs:
 
       - name: Checkout repository [libbitcoin-database]
         id: checkout-libbitcoin-database
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
           path: 'libbitcoin-database'
@@ -441,7 +455,7 @@ jobs:
         shell: bash
         working-directory: 'libbitcoin-database'
         env:
-          COVERALLS_REPO_TOKEN: ${{ secrets.github_token }}
+          COVERALLS_REPO_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           curl -sLO https://github.com/coverallsapp/coverage-reporter/releases/latest/download/coveralls-linux-x86_64.tar.gz
           curl -sLO https://github.com/coverallsapp/coverage-reporter/releases/latest/download/coveralls-checksums.txt
@@ -475,7 +489,7 @@ jobs:
 
       - name: Test artifact upload
         if: failure()
-        uses: actions/upload-artifact@v7.0.1
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: testlogs
           path: ${{ github.workspace }}/*.errors
@@ -803,7 +817,7 @@ jobs:
       - name: Checkout repository [libbitcoin-system]
         id: checkout-libbitcoin-system
         continue-on-error: true
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
           path: 'libbitcoin-system'
@@ -820,7 +834,7 @@ jobs:
 
       - name: Checkout repository [libbitcoin-database]
         id: checkout-libbitcoin-database
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
           path: 'libbitcoin-database'
@@ -889,7 +903,7 @@ jobs:
         shell: bash
         working-directory: 'libbitcoin-database'
         env:
-          COVERALLS_REPO_TOKEN: ${{ secrets.github_token }}
+          COVERALLS_REPO_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           curl -sLO https://github.com/coverallsapp/coverage-reporter/releases/latest/download/coveralls-linux-x86_64.tar.gz
           curl -sLO https://github.com/coverallsapp/coverage-reporter/releases/latest/download/coveralls-checksums.txt
@@ -923,7 +937,7 @@ jobs:
 
       - name: Test artifact upload
         if: failure()
-        uses: actions/upload-artifact@v7.0.1
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: testlogs
           path: ${{ github.workspace }}/*.errors
@@ -1187,7 +1201,7 @@ jobs:
       - name: Checkout repository [libbitcoin-system]
         id: checkout-libbitcoin-system
         continue-on-error: true
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
           path: 'libbitcoin-system'
@@ -1204,7 +1218,7 @@ jobs:
 
       - name: Checkout repository [libbitcoin-database]
         id: checkout-libbitcoin-database
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
           path: 'libbitcoin-database'
@@ -1268,7 +1282,7 @@ jobs:
         shell: bash
         working-directory: 'libbitcoin-database'
         env:
-          COVERALLS_REPO_TOKEN: ${{ secrets.github_token }}
+          COVERALLS_REPO_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           curl -sLO https://github.com/coverallsapp/coverage-reporter/releases/latest/download/coveralls-linux-x86_64.tar.gz
           curl -sLO https://github.com/coverallsapp/coverage-reporter/releases/latest/download/coveralls-checksums.txt
@@ -1302,7 +1316,7 @@ jobs:
 
       - name: Test artifact upload
         if: failure()
-        uses: actions/upload-artifact@v7.0.1
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: testlogs
           path: ${{ github.workspace }}/*.errors
@@ -1355,17 +1369,18 @@ jobs:
           fi
 
       - name: Set msbuild path
-        uses: microsoft/setup-msbuild@v3
+        uses: microsoft/setup-msbuild@30375c66a4eea26614e0d39710365f22f8b0af57 # v3
         with:
           msbuild-architecture: x64
 
       - name: Checkout repository [libbitcoin-system]
         id: checkout-libbitcoin-system
         continue-on-error: true
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
           path: 'libbitcoin-system'
+          persist-credentials: false
           ref: ${{ steps.get-branch.outputs.branch }}
           repository: ${{ github.repository_owner }}/libbitcoin-system
 
@@ -1378,10 +1393,11 @@ jobs:
 
       - name: Checkout repository [libbitcoin-database]
         id: checkout-libbitcoin-database
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
           path: 'libbitcoin-database'
+          persist-credentials: false
           repository: ${{ github.repository }}
 
       - name: Execute build
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 470f5dbe5..a9ab16c9b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,6 +19,8 @@ on:
       - 'test/**'
       - 'tools/initchain/**'
   push:
+    tags-ignore:
+      - "**"
     paths:
       - 'builds/cmake/**'
       - 'builds/gnu/**'
@@ -33,6 +35,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.repository_owner == 'libbitcoin' && (github.event.pull_request.number || github.run_id) || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   information:
     runs-on: ubuntu-latest
@@ -40,6 +45,9 @@ jobs:
     env:
       CONCURRENCY_GROUP: ${{ github.workflow }}-${{ github.repository_owner == 'libbitcoin' && (github.event.pull_request.number || github.run_id) || github.ref }}
 
+    permissions:
+      actions: write
+
     steps:
         - name: state
           run: |
@@ -52,6 +60,14 @@ jobs:
             echo "base_ref : ${{ github.base_ref }}"
             echo "head_ref : ${{ github.head_ref }}"
 
+        - name: cancel on pull_request closed
+          if: github.event_name == 'pull_request' && github.event.action == 'closed'
+          env:
+            GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          run: |
+            gh api --method POST \
+              -H "Accept: application/vnd.github+json"   "/repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/cancel"
+
 
   gnu:
     if: github.event_name != 'pull_request' || github.event.action != 'closed'
@@ -134,7 +150,7 @@ jobs:
       - name: Checkout repository [libbitcoin-system]
         id: checkout-libbitcoin-system
         continue-on-error: true
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
           path: 'libbitcoin-system'
@@ -151,7 +167,7 @@ jobs:
 
       - name: Checkout repository [libbitcoin-database]
         id: checkout-libbitcoin-database
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
           path: 'libbitcoin-database'
@@ -220,7 +236,7 @@ jobs:
         shell: bash
         working-directory: 'libbitcoin-database'
         env:
-          COVERALLS_REPO_TOKEN: ${{ secrets.github_token }}
+          COVERALLS_REPO_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           curl -sLO https://github.com/coverallsapp/coverage-reporter/releases/latest/download/coveralls-linux-x86_64.tar.gz
           curl -sLO https://github.com/coverallsapp/coverage-reporter/releases/latest/download/coveralls-checksums.txt
@@ -254,7 +270,7 @@ jobs:
 
       - name: Test artifact upload
         if: failure()
-        uses: actions/upload-artifact@v7.0.1
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: testlogs
           path: ${{ github.workspace }}/*.errors
@@ -342,7 +358,7 @@ jobs:
       - name: Checkout repository [libbitcoin-system]
         id: checkout-libbitcoin-system
         continue-on-error: true
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
           path: 'libbitcoin-system'
@@ -359,7 +375,7 @@ jobs:
 
       - name: Checkout repository [libbitcoin-database]
         id: checkout-libbitcoin-database
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
           path: 'libbitcoin-database'
@@ -428,7 +444,7 @@ jobs:
         shell: bash
         working-directory: 'libbitcoin-database'
         env:
-          COVERALLS_REPO_TOKEN: ${{ secrets.github_token }}
+          COVERALLS_REPO_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           curl -sLO https://github.com/coverallsapp/coverage-reporter/releases/latest/download/coveralls-linux-x86_64.tar.gz
           curl -sLO https://github.com/coverallsapp/coverage-reporter/releases/latest/download/coveralls-checksums.txt
@@ -462,7 +478,7 @@ jobs:
 
       - name: Test artifact upload
         if: failure()
-        uses: actions/upload-artifact@v7.0.1
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: testlogs
           path: ${{ github.workspace }}/*.errors
@@ -516,7 +532,7 @@ jobs:
       - name: Checkout repository [libbitcoin-system]
         id: checkout-libbitcoin-system
         continue-on-error: true
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
           path: 'libbitcoin-system'
@@ -533,7 +549,7 @@ jobs:
 
       - name: Checkout repository [libbitcoin-database]
         id: checkout-libbitcoin-database
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
           path: 'libbitcoin-database'
@@ -597,7 +613,7 @@ jobs:
         shell: bash
         working-directory: 'libbitcoin-database'
         env:
-          COVERALLS_REPO_TOKEN: ${{ secrets.github_token }}
+          COVERALLS_REPO_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           curl -sLO https://github.com/coverallsapp/coverage-reporter/releases/latest/download/coveralls-linux-x86_64.tar.gz
           curl -sLO https://github.com/coverallsapp/coverage-reporter/releases/latest/download/coveralls-checksums.txt
@@ -631,7 +647,7 @@ jobs:
 
       - name: Test artifact upload
         if: failure()
-        uses: actions/upload-artifact@v7.0.1
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: testlogs
           path: ${{ github.workspace }}/*.errors
@@ -672,17 +688,18 @@ jobs:
           fi
 
       - name: Set msbuild path
-        uses: microsoft/setup-msbuild@v3
+        uses: microsoft/setup-msbuild@30375c66a4eea26614e0d39710365f22f8b0af57 # v3
         with:
           msbuild-architecture: x64
 
       - name: Checkout repository [libbitcoin-system]
         id: checkout-libbitcoin-system
         continue-on-error: true
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
           path: 'libbitcoin-system'
+          persist-credentials: false
           ref: ${{ steps.get-branch.outputs.branch }}
           repository: ${{ github.repository_owner }}/libbitcoin-system
 
@@ -695,10 +712,11 @@ jobs:
 
       - name: Checkout repository [libbitcoin-database]
         id: checkout-libbitcoin-database
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
           path: 'libbitcoin-database'
+          persist-credentials: false
           repository: ${{ github.repository }}
 
       - name: Execute build
diff --git a/.github/workflows/version-tag.yml b/.github/workflows/version-tag.yml
index e51ae03e2..3fe51918b 100644
--- a/.github/workflows/version-tag.yml
+++ b/.github/workflows/version-tag.yml
@@ -38,8 +38,8 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-        - name: Checkout
-          uses: actions/checkout@v6
+       - name: Checkout
+         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
           with:
             fetch-depth: 0
             ref: ${{ github.event.inputs.branch || 'master' }}